CVE-2006-0147 Code injection in n/a
Remote attackers can execute arbitrary PHP code via the do parameter in the ADOdb test script, affecting multiple applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-0147?
CVE-2006-0147 is a high-severity code injection vulnerability in Moodle Moodle, published on 9 Jan 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.
Which versions are affected by CVE-2006-0147?
It affects 5 products.
Products include John Lim Adodb, Mantis Mantis, Moodle Moodle, Postnuke Software Foundation Postnuke, The Cacti Group Cacti.
How do I fix CVE-2006-0147?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2006-0147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-0147 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Moodle Moodle
Sources
Also known as DEBIAN-CVE-2006-0147, GHSA-8348-4394-v2hm.